Mozilla -- multiple vulnerabilities

2026-01-15 · CVE-2026-0891, CVE-2026-0890, CVE-2026-0887, CVE-2026-0885, CVE-2026-0884, CVE-2026-0883, CVE-2026-0878 · VuXML entry

Memory safety bugs present in firefox-esr 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. Clickjacking issue and information disclosure in the PDF Viewer component. Use-after-free in the JavaScript: GC component. Use-after-free in the JavaScript Engine component. Information disclosure in the Networking component. Sandbox escape due to …

Affected versions

• firefox < 147.0.0,2
• firefox-esr < 140.7.0,2
• thunderbird < 147

By system

3 still vulnerable, 3 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.